Starr unit prevails in dispute over cyber policy

A federal appeals court affirmed a lower court ruling in favor of a Starr Insurance Cos. unit Friday in a dispute over the interpretation of a cyber policy in connection with an apparent phishing scheme.

In June 2017, Starr Surplus Lines Insurance Co. issued a “Security & Privacy Response Policy” to Alorica Inc., an Irvine, California-based customer service company, that provided up to $10 million in coverage with a retention of $500,000, according to court papers in Alorica Inc. v. Starr Surplus Lines Insurance Co.

Between October and December 2017, an unknown party infiltrated Alorica’s email system, likely through a phishing scam, and directed Alorica clients to wire transfer payments to its own accounts, according to court papers.

These clients included St. Louis-based Express Scripts Holdings Inc., which in response to emails, wired $4.8 million it owed Alorica to a fraudulent account.

In a Sept. 28, 2018, letter in response to Alorica’s request for the $4.8 million, Express Scripts said that while it would pay $56,791 that had been recovered, it would not make additional payments for the remaining portion. Alorica and Express Scripts have not filed any litigation between them over this issue, according to court papers.

After Starr informed Alorica that the matter did not trigger a claim under its coverage, Alorica sued the insurer in U.S. District Court in Pasadena, charging breach of contract and breach of the covenant of good faith and fair dealing.

The lower court ruled in Starr’s favor and was affirmed by a unanimous three-judge appeals court panel. The Express Scripts letter does not fall within the definition of a claim under the policy, the appellate panel said.

“In relevant part, the policy defines a ‘claim’ as a ‘written demand for monetary or non-monetary relief. Express Scripts’ letter does not fall within that definition,” it said.

“The letter rejects Alorica’s demand for $4.8 million,” the ruling said.  “A refusal to accept a demand is not itself a demand, it is only a refusal.  Express Script’s letter does not ask Alorica to do anything at all.”

Attorneys in the case did not respond to a request for comment.

In February, a federal district court in Dallas ruled that American International Group Inc. and Beazley PLC units were not obligated to compensate a property management software company for money lost in a phishing scheme because it never technically held the funds that were stolen.